Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RE: [SURBL-Discuss] Re: Using (SU)RBL with a browser, any way to do it? (was <snip> )
by Chris Santerre 13 Jul '04

13 Jul '04

>-----Original Message----- >From: Nicolas Riendeau [mailto:knightr@istop.com] >Sent: Sunday, July 11, 2004 8:10 PM >To: William Stearns; SURBL Discussion list >Subject: [SURBL-Discuss] Re: Using (SU)RBL with a browser, any >way to do >it? (was <snip> ) > > >> Good morning, Nicolas, > >Hi William! > >> What's the problem with using a proxy? I have instructions at >> http://www.stearns.org/sa-blacklist/ on how to use the >sa-blacklist (the >> data underlying ws.surbl.org) in both squid and privoxy, using those >> proxies to block web access to the spammer web sites. >> Squid, at least, is available on both unix and windows (see >> http://www.cygwin.com). > >Thanks, I didn't know that... > >The fact that it works on Windows would take care of one of >the problems as the >number of *nix admins where I work is somewhat limited >compared to the number of >Windows admins... > >Only problem left now would be to convince them to invest in >the necessary hardware... > >> If you use a different proxy, I'd be glad to work with you to >> provide the sa-blacklist in a form suitable for that proxy. >> Cheers, >> - Bill > >Thanks! > >Nick > Or one could take the sa-blacklist file and turn it into a quick hosts file. I have a host file on the server that is copied to everyones machine everytime they log in. Full of spyware domains that simply point to 127.0.0.1 and It is easy for me to change. However squid also rocks. I have had a test server running for 1.5 years. I haven't had time to tweak it yet to go production yet. --Chris

2 1

Help: kid pron.....help report
by Chris Santerre 13 Jul '04

13 Jul '04

Good grief I have been going thru the domains submitted into SURBL and came up with a nasty kiddie pron site. Anyone here have contact with Secret Service or anyone else for that matter? I don't want the site just shutdown, I want these guys caught. *Warning, very disturbing site!* haydn.e-pid.org Address: 61.128.198.123 resolved to haydn.e-pid.org AS: 61.128.128.0/17 AS4134 [CN] Data Communications Bureau Beijing Net 61.128.128-255 CHINANET-CQ [CN] @ns.chinanet.cn.net --Chris

6 6

RE: [SURBL-Discuss] msu.edu hell yeah!
by Chris Santerre 12 Jul '04

12 Jul '04

>-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Monday, July 12, 2004 11:18 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] msu.edu hell yeah! > > >Good morning, Chris, > >On Mon, 12 Jul 2004, Chris Santerre wrote: > >> Just wanted to let you guys know that MSU is using surbl.org. > > With Spamassassin, or with some other MTA/software combination? > >> We rock ;) > > I personally pebble, on a good day. :-) > Cheers, > - Bill :) With SA. --Chris

1 0

RE: First submission questions
by Chris Santerre 12 Jul '04

12 Jul '04

Hi Ryan, thanks for the submissions. I'm about to give them a quick going thru. The best place to ask these questions is right on the SURBL list discuss(a)lists.surbl.org I'm cc'ing this to the list. The more eyes on it the better. Redirects are handled differently. Post them to discussion list and they get added to a redirect list. The rule of thumb is like cooking: "When in doubt, throw it out." We would much rather not list a spammer, then list a shammer. Unless we decide together that the shammer is 95% spam with 1 legit customer. Then we might list them and inform the legit customer. Sometimes we don't all agree. Like political spam. Thats were we have some real fun ;) --Chris >-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Saturday, July 10, 2004 4:41 PM >To: Chris Santerre >Subject: First submission questions > > > >Hi Chris, > >I just submitted a "short list" of 87 domains to >chris+rthompson(a)moglobal.com, as kind of a proof-of-concept. I did take >quite a bit of care in the classification of these domains, so *I'm* >confident about them, but there are a few grey areas that I wasn't sure >if you'd agree with. Can you offer a bit of advice? > >Some I wasn't sure about are below. Also, if there's a person or list >that would be better equipped to advise on this kind of thing, please >let me know. I want to quickly become more help than burden, obviously. >:-) I'll be quieter once I better understand your inclusion system. > >Spam username hosts, but possibly also legit sites? I can't read >Taiwanese, nor do I really want to. In any case, these are >probably safe >for inclusion in English block lists. >twfc.org.tw Hosts spammers >club.net.tw Random hostname spammers >f2m.idv.tw Seems to process email forms for spammers >apol.com.tw mail.apol.com.tw seems to host /~spammers/ >pchome.com.tw Multiple NANAS mentions >netking.com.tw Multiple NANAS mentions > >Image hosts: >vendio.com eBay spammers image host; multiple NANAS >hinet.net has been mentioned before; they are rather notorious > >Obfuscated/invalid/mistyped URIs that get_uri_list picked up on: >interfun_lacing.jpg Local image URL >internet.e-mail Fake URL seen in spam >dnatzweirq2.ru Obfu for dazer2.ru >new_page_2.files Weird fake URL >wwwacronmedia.biz Mistyped spammer URL > >Iffy redirects: >tadpole.com Funny redirect destination in software spam? >61.218.32.78 Redirector; down now? >tadpolecomputer.com Funny redirect destination in software spam? > >- Ryan > >-- > Ryan Thompson <ryan(a)sasknow.com> > > SaskNow Technologies - http://www.sasknow.com > 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 > > Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon > Toll-Free: 877-727-5669 (877-SASKNOW) North America >

3 2

j-chkmail and SURBL
by Jose-Marcio.Martins＠ensmp.fr 12 Jul '04

12 Jul '04

Hello, j-chkmail is the filter I developed. It's completely written in C language. It's intended to use very few ressources and be very fast. Version 1.7 experimental has an interface for SURBL. I'm using it for two months now. There are two interfaces to SURBL : DNS and local database. DNS based queries are much easier to administrate, but local databases are faster. For the moment, only queries on local databases are validated. DNS queries is implemented but not yet validated. j-chkmail is free software, but with downloading is limited to registered users. To become a registered user, you shall accept to identify yourself : name, domain, ..., and have some responsibility on the domain you'll be using it (don't ask a license to hotmail.com, unless you're the hotmail.com system administrator... 8-). You can check it at : http://j-chkmail.ensmp.fr Best, Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

1 0

RE: [SURBL-Discuss] Hand classification / Scripted submission
by Chris Santerre 09 Jul '04

09 Jul '04

>> >3) Is there any advantage to submitting the same URI more than once >> > (i.e., from different spam messages?) It seems like the answer is >> > probably "no", but I'll gladly accept enlightenment. >> >> See my answer to #1. ;) > >:-) So noted, for WS. I've already had responses from other SURBLs that >are actually ranking by frequency of submissions, and encouraging >multiple submissions of the same URI if it appears in multiple spams. > Just a note on this for why I don't want multiples. I want multiples, but from different sources. The same person sending the same domain 5 times tells me nothing. But 5 different people submitting means a lot! > >> SURBL is the sexiest thing since.....well....me! :P > >Uhh... I'm not going to comment on that. For many reasons. :-) That's right, nothing to see here. Keep moving... :) > >> >Now I want to give something back. >> >> I keep getting this and I use the standard reply of: "I'll take 1 >> Dodge Hennessy Venom 800TT." >> >> Still no takers :) > >Well, I had one last week, but it was silver and had little plastic >ninjas stuck all over it, and a personalized plate of "SPAMD", so I >put it on an auction on Monday. If I would have known sooner... > Doh! You guys from saskachuan! If it can't mount a moose on it, you sell it! ;) --Chris

1 0

RE: [SURBL-Discuss] Hand classification / Scripted submission
by Chris Santerre 09 Jul '04

09 Jul '04

> >Questions: >1) Is this approach reasonable (i.e., am I going to hear screams from > someone if I script this, assuming I take precautions, >rate-limit the > submissions, and check the results before turning it loose?) I will shoot you! :) >2) Is there already a more efficient way to submit URIs? (Besides > running my own list, which, I guess, isn't too unreasonable :-) Yes. I'm going to email you off list. >3) Is there any advantage to submitting the same URI more than once > (i.e., from different spam messages?) It seems like the answer is > probably "no", but I'll gladly accept enlightenment. See my answer to #1. ;) >4) Should I be submitting to multiple SURBLs, or just stick with > ws.surbl.org? > most people are running [SC] and [WS] so [WS] is fine. >Since implementing SURBLs in SA2.63 about a week ago, we've had amazing >success. So much that we're having occasional word-wrap issues with the >X-Spam-Level: (stars) header. :-) > SURBL is the sexiest thing since.....well....me! :P >Now I want to give something back. I keep getting this and I use the standard reply of: "I'll take 1 Dodge Hennessy Venom 800TT." Still no takers :) I'm thinking of aiming smaller with an Nvidia 6800 video card. --Chris

2 1

RE: [SURBL-Discuss] Yahoo.net FP in ws.
by Chris Santerre 09 Jul '04

09 Jul '04

Actually I think I already beat you on that Bill ;) Muahahahah behold the speed of the big ape on caffene and techno music! --Chris >-----Original Message----- >From: William Stearns [mailto:wstearns@pobox.com] >Sent: Friday, July 09, 2004 10:53 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Yahoo.net FP in ws. > > >Good morning, Patrick, > >On Fri, 9 Jul 2004, Patrik Nilsson wrote: > >> This one needs to whitelisted... >> >> Domain yahoo.net, listed in: >> ws.surbl.org > > Thanks for the report! That'll be removed in the 11:00 update. > Cheers, > - Bill > >--------------------------------------------------------------- >------------ > "cc:Mail is a wonderful application, as long as you don't want >to read or send mail." >(Courtesy of Nix <nix(a)esperi.demon.co.uk>) >--------------------------------------------------------------- >----------- >William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, >freedups, p0f, >rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org -------------------------------------------------------------------------- _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

Yahoo.net FP in ws.
by Patrik Nilsson 09 Jul '04

09 Jul '04

This one needs to whitelisted... Domain yahoo.net, listed in: ws.surbl.org Thanks, Patrik

2 1

RE: [RD] BIGEVIL the big one, just went live!
by Chris Santerre 09 Jul '04

09 Jul '04

I'm cc'ing this to the SURBL list. But I think the answer may just be.... SA 3.0 :) --Chris >-----Original Message----- >From: Chr. von Stuckrad [mailto:stucki@mi.fu-berlin.de] >Sent: Friday, July 09, 2004 9:55 AM >To: Spamassassin-Talk (E-mail) >Subject: Re: [RD] BIGEVIL the big one, just went live! > > >... >> >Is *such* a large increase 'correct'? >> >Or do I have to seach for other trouble than *BIG*_evil? >... >> No that is correct. Bigevil got 10x bigger. I am worried abuot larger >... >> surbl.org is the way to go. If you can't do net tests, rsync >it and do it >> locally. > >OK, in my 'normal' system, using a self-compiled Version >I can (and did) do that, but > > DEBIAN 'original' Packages do not contain the > SURBL-Patch, so can NOT go that way > >Does somebody know, how to 'splice' those patches >into an otherwise completely unchanged way of using >debian packages? > >Stucki > >-- >Christoph von Stuckrad * * |nickname |<stucki(a)math.fu-berlin.de>\ >Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459| >Fachbereich Mathematik, EDV|\ *|if online|Tel(else):+49 30 77 39 6600| >Arnimallee 2-6/14195 Berlin* * |on IRCnet|Fax(alle):+49 30 838-75454/ >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss